The flaw resides in the way pre-authentication Type size and count values are processed, allowing a malicious actor to trigger an excessive memory allocation. The resulting out-of-memory condition can bring an AMQP service to a halt, matching the characteristics of CWE-789, Uncontrolled Memory Allocation.

The issue affects Apache Qpid Proton Dotnet, through 1.0.0, regardless of the deployment context. Any .NET application that incorporates this library and accepts AMQP traffic is susceptible.

The vulnerability can be exploited by an attacker who succeeds in sending a crafted message before authentication is established, so no prior access or credentials are required. The attack therefore has a low likelihood of occurrence for exposed services, reflecting the EPSS score of < 1%. The CVSS score of 7.5 and an EPSS score of < 1% indicate a medium to high severity with a low but non-zero probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The lack of authentication barriers and the potential for a denial-of-service attack make the risk significant.